diff --git a/src/agents/configured-provider-fallback.ts b/src/agents/configured-provider-fallback.ts
index d1b5af86f8f..04dd32c4443 100644
--- a/src/agents/configured-provider-fallback.ts
+++ b/src/agents/configured-provider-fallback.ts
@@ -1,6 +1,6 @@
 import type { OpenClawConfig } from "../config/types.js";
 
-export type ProviderModelRef = {
+type ProviderModelRef = {
   provider: string;
   model: string;
 };
diff --git a/src/agents/mcp-http.ts b/src/agents/mcp-http.ts
index 266a9a7a5eb..594338a7e0f 100644
--- a/src/agents/mcp-http.ts
+++ b/src/agents/mcp-http.ts
@@ -6,13 +6,13 @@ import { isMcpConfigRecord, toMcpStringRecord } from "./mcp-config-shared.js";
 
 export type HttpMcpTransportType = "sse" | "streamable-http";
 
-export type HttpMcpServerLaunchConfig = {
+type HttpMcpServerLaunchConfig = {
   transportType: HttpMcpTransportType;
   url: string;
   headers?: Record<string, string>;
 };
 
-export type HttpMcpServerLaunchResult =
+type HttpMcpServerLaunchResult =
   | { ok: true; config: HttpMcpServerLaunchConfig }
   | { ok: false; reason: string };
 
diff --git a/src/agents/mcp-stdio.ts b/src/agents/mcp-stdio.ts
index 7776e2296c4..84343b94e4e 100644
--- a/src/agents/mcp-stdio.ts
+++ b/src/agents/mcp-stdio.ts
@@ -1,6 +1,6 @@
 import { isMcpConfigRecord, toMcpEnvRecord, toMcpStringArray } from "./mcp-config-shared.js";
 
-type StdioMcpServerLaunchConfig = {
+export type StdioMcpServerLaunchConfig = {
   command: string;
   args?: string[];
   env?: Record<string, string>;
@@ -50,5 +50,3 @@ export function describeStdioMcpServerLaunchConfig(config: StdioMcpServerLaunchC
   const cwd = config.cwd ? ` (cwd=${config.cwd})` : "";
   return `${config.command}${args}${cwd}`;
 }
-
-export type { StdioMcpServerLaunchConfig, StdioMcpServerLaunchResult };
diff --git a/src/agents/mcp-transport-config.ts b/src/agents/mcp-transport-config.ts
index 7083174f251..bd0b92ff5fa 100644
--- a/src/agents/mcp-transport-config.ts
+++ b/src/agents/mcp-transport-config.ts
@@ -17,7 +17,7 @@ type ResolvedBaseMcpTransportConfig = {
   connectionTimeoutMs: number;
 };
 
-export type ResolvedStdioMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
+type ResolvedStdioMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
   kind: "stdio";
   transportType: "stdio";
   command: string;
@@ -26,16 +26,14 @@ export type ResolvedStdioMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
   cwd?: string;
 };
 
-export type ResolvedHttpMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
+type ResolvedHttpMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
   kind: "http";
   transportType: HttpMcpTransportType;
   url: string;
   headers?: Record<string, string>;
 };
 
-export type ResolvedMcpTransportConfig =
-  | ResolvedStdioMcpTransportConfig
-  | ResolvedHttpMcpTransportConfig;
+type ResolvedMcpTransportConfig = ResolvedStdioMcpTransportConfig | ResolvedHttpMcpTransportConfig;
 
 const DEFAULT_CONNECTION_TIMEOUT_MS = 30_000;
 
diff --git a/src/agents/mcp-transport.ts b/src/agents/mcp-transport.ts
index 2429284d7f1..302c0fb75fd 100644
--- a/src/agents/mcp-transport.ts
+++ b/src/agents/mcp-transport.ts
@@ -10,7 +10,7 @@ import { normalizeOptionalString } from "../shared/string-coerce.js";
 import { OpenClawStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
 
-export type ResolvedMcpTransport = {
+type ResolvedMcpTransport = {
   transport: Transport;
   description: string;
   transportType: "stdio" | "sse" | "streamable-http";
diff --git a/src/agents/model-catalog-visibility.ts b/src/agents/model-catalog-visibility.ts
index 0fd8b1a15e5..bd46625c622 100644
--- a/src/agents/model-catalog-visibility.ts
+++ b/src/agents/model-catalog-visibility.ts
@@ -3,7 +3,7 @@ import type { ModelCatalogEntry } from "./model-catalog.js";
 import { createProviderAuthChecker } from "./model-provider-auth.js";
 import { buildAllowedModelSet, buildConfiguredModelCatalog, modelKey } from "./model-selection.js";
 
-export type ModelCatalogVisibilityView = "default" | "configured" | "all";
+type ModelCatalogVisibilityView = "default" | "configured" | "all";
 
 function sortModelCatalogEntries(entries: ModelCatalogEntry[]): ModelCatalogEntry[] {
   return entries.toSorted(
diff --git a/src/agents/model-runtime-aliases.ts b/src/agents/model-runtime-aliases.ts
index dd24992cbed..366a71b8968 100644
--- a/src/agents/model-runtime-aliases.ts
+++ b/src/agents/model-runtime-aliases.ts
@@ -3,7 +3,7 @@ import { normalizeAgentId } from "../routing/session-key.js";
 import { resolveAgentRuntimePolicy } from "./agent-runtime-policy.js";
 import { normalizeProviderId } from "./provider-id.js";
 
-export type LegacyRuntimeModelProviderAlias = {
+type LegacyRuntimeModelProviderAlias = {
   /** Legacy provider id that encoded the runtime in the model ref. */
   legacyProvider: string;
   /** Canonical provider id that should own model selection. */
@@ -50,7 +50,7 @@ export function listLegacyRuntimeModelProviderAliases(): readonly LegacyRuntimeM
   return LEGACY_RUNTIME_MODEL_PROVIDER_ALIASES;
 }
 
-export function resolveLegacyRuntimeModelProviderAlias(
+function resolveLegacyRuntimeModelProviderAlias(
   provider: string,
 ): LegacyRuntimeModelProviderAlias | undefined {
   return LEGACY_ALIAS_BY_PROVIDER.get(normalizeProviderId(provider));
diff --git a/src/agents/owner-display.ts b/src/agents/owner-display.ts
index 82f56451fb6..0ce8feb3d0a 100644
--- a/src/agents/owner-display.ts
+++ b/src/agents/owner-display.ts
@@ -2,12 +2,12 @@ import crypto from "node:crypto";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { normalizeOptionalString } from "../shared/string-coerce.js";
 
-export type OwnerDisplaySetting = {
+type OwnerDisplaySetting = {
   ownerDisplay?: "raw" | "hash";
   ownerDisplaySecret?: string;
 };
 
-export type OwnerDisplaySecretResolution = {
+type OwnerDisplaySecretResolution = {
   config: OpenClawConfig;
   generatedSecret?: string;
 };
diff --git a/src/agents/payload-redaction.ts b/src/agents/payload-redaction.ts
index 00ba471d995..830cbc16976 100644
--- a/src/agents/payload-redaction.ts
+++ b/src/agents/payload-redaction.ts
@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import { estimateBase64DecodedBytes } from "../media/base64.js";
 import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";
 
-export const REDACTED_IMAGE_DATA = "<redacted>";
+const REDACTED_IMAGE_DATA = "<redacted>";
 
 const NON_CREDENTIAL_FIELD_NAMES = new Set([
   "passwordfile",